website.* endpoints manage those websites:
- website.status — inspect publish state, live URL, visibility
- website.listCheckpoints — browse version history
- website.publish — deploy the latest checkpoint
- website.update — change website configuration without redeploying
To have an agent build a website, create a task with task.create. Once the session has a website attached, the endpoints on this page take over.
Quickstart: publish a site
After the agent has built something (the task’s session now has a website), deploy it with one call and poll for the live URL:website.publish returns immediately while the deploy runs in the background.
The response does not echo visibility. Read website.status.visibility after the publish request to confirm the effective value.
Other common flows
Ship an updated build. After the agent makes more changes (new checkpoints), callwebsite.publish again — it always deploys the latest checkpoint. There is no way to pin an older checkpoint via this API. Pass visibility again on every republish when the site is not public; omitting it resets the site to public.
Publish for the owner and invited collaborators only. Pass "visibility": "private" when publishing:
data[].version_id against published_version_id in the same response to find which checkpoint is currently live.
Change metadata without redeploying.
Reference
Anatomy of a website
Locating a website
All four endpoints accept eithertask_id or website_id — exactly one must be provided:
Website access
Website access is evaluated for the user represented by the API key or OAuth token. The website owner can read and write it. Other callers inherit access from the website’s source task: read access allowswebsite.status and website.listCheckpoints, while write access allows website.publish and website.update.
For website.*, OAuth client scopes and client identity do not further restrict which websites the authorized user can access. This differs from task.*: a standard client with only create_task can operate a website whose source task was not created by that client, provided the authorized user has the required website access.
A request returns 403 permission_denied when the authorized user lacks the required access.
Site URLs
When a site is published,website.status returns site_urls — an array of every hostname the site can be reached on, ordered from default to most specific:
- Space URL —
https://{space_id}.manus.space. Always present for a published site. - Sub-domain URL —
https://{sub_domain}.manus.space. Only when the owner has configured a sub-domain. - Custom domains —
https://{custom_domain}for each active custom domain bound by the owner.
site_urls[0] is enough — it’s always the space URL. The array is empty whenever publish_status is not published.
Publish states
Checkpoint status vs. publish state
A checkpoint’s ownstatus (pending / success / failed / unspecified) only says whether the snapshot was generated successfully — a success checkpoint is not automatically live. To find the live version, compare website.status.version_id (or website.listCheckpoints.published_version_id) against data[].version_id.
Visibility
Sites may additionally cap the maximum visibility they accept — for example, a team-only site cannot be set to
public. Requests that exceed the allowed visibility return 403 permission_denied.